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DETAILED ACTION 

1. Claims 1-14 remain in the application. Applicant has amended claim 7. 

Allowable Subject Matter 

2. Claims 5 and 7-10 are objected to as being dependent upon a rejected base claim, but 
would be allowable if rewritten in independent form including all of the limitations of the base 
claim and any intervening claims. 

Claim Rejections - 35 USC § 103 

3. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

4. Claims 1-2, 6, 12, and 14 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Deianov et al. (U.S. 6,529,985 Bl) in view of Hammond (U.S. 6,463,583 Bl). 

5. As to claim 1, Deianov teaches an activation module (an interception module, a modified 
loader program; col. 3, lines 35-54), an interception module (a system call wrapper; an 
initialization module; col. 3, lines 47-54), the activation module being adapted to load the 
interception module (the modified loader loads an initialization module and a system call 
wrapper; col. 3, lines 47-54), the activation module being adapted to redirect the one or more 
API calls by creating an alias to any page containing an entry point for an API call to be 
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intercepted and to write the address of the interception module to the alias (Pointers 1 14 to 
system calls 115 are located in an operating system interrupt vector table 113 ... to the 
interception module 1 1 1 to execute the interception module 111; col. 6, lines 5-38), the 
activation module being adapted to provide to any instances of the interception module the 
original entry points for the one or more API calls (the interception module 1 1 1 first writes, to 
the return address area 129 of the system call wrapper 125, the address to which to return 
execution after the system call wrapper 125 terminates; col. 8, line 56 - col. 9, line 13), and the 
interception module being adapted to selectively provide modified functionality for the 
intercepted API calls (When a call is made ... not all system calls 115 need be intercepted; col. 6, 
lines 35-40 and alternative object code to be executed instead of the system call . . . system call 
wrapper; col 1, line 64 - col. 2, line 2). 

6. However, Deianov does not teach loading the interception module to occupy a location in 
a shared region of virtual memory as long as interception of the API calls is required. Hammond 
teaches loading the interception module to occupy a location in a shared region of virtual 
memory as long as interception of the API calls is required (an injection dynamic link library 
called INJECT.DLL is loaded from the injection application into a second pre-determined 
memory location within an area of shared memory; col. 8, lines 36-67). 

7. It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to combine the teaching of Hammond and Deianov because Hammond teaching o 
loading the interception module would improve the flexibility of Deianov' s system by 
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dynamically injecting the execution logic into a shared memory space of a window operating 
system (col. 2, lines 56-58) 

8. As to claim 2, Deianov does not explicitly teach the activation module is adapted to load 
the interception module at system initialization time. Hammond teaches the activation is adapted 
to load the interception module at system initialization time (an injection application is started 
with a kernel application ... for the windowed operating system; col. 5, lines 46-58). 

9. As to claim 6, Deianov teaches the interception module is adapted to export one or more 
global variables located in its code segment to the activation module (The initialization module 
123 ... select process 107; col. 7, lines 5-29), each global variable corresponding to an API call 
to be intercepted (the entry point in the system call wrapper; col. 7, lines 5-29), the activation 
module being adapted to create an alias to any page containing one of the one or more global 
variables to write the original entry point of the one or more API calls to the respective aliases 
(Pointers 1 14 to system calls 1 15 are located in an operating system interrupt vector table 113 ... 
to the interception module 1 1 1 to execute the interception module 111; col. 6, lines 5-38). 

10. As to claim 12, Deianov does not explicitly teach one or more API calls to be intercepted 
is a call for allocating memory, however, Deianov teaches a system call performs some system 
operations, such as the access of a system hardware or software (col 1, lines 31-44). It would 
have been obvious the call for allocating memory could also be intercepted. 
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11. As to claim 14, Deianov teaches computer program code stored on a computer readable 
storage medium for intercepting API calls when executed on a virtual memory computer system, 
the program code comprising the system of claim 1 (A computer memory 101 ... into the 
operating system 117; col. 5, lines 50-66). 

12. Claims 3-4 and 1 1 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Deianov et al (U.S. 6,529,985 Bl) in view of Hammond (U.S. 6,463,583 Bl) further in view of 
Pietrek (Learn System-Level Win32 Coding Techniques by Writing an API Spy Program). 

13. As to claim 3, Deianov teaches the activation module is adapted to read a configuration 
file (a list of selected processes ... of a default loader program; col. 8, lines 1-11). 

14. However, Deianov does not teach the configuration file containing data defining the API 
calls to be intercepted and the manner in which the API calls are to be modified, the activation 
module being adapted to write the configuration data to an area of shared memory and to 
provides to all instances of the interception module the location of the shared memory. Pietrek 
teaches the configuration file containing data defining the API calls to be intercepted (the spy 
DLL reads an input file . . . about the function's parameters; page 8), the activation module being 
adapted to write the configuration data to an area of memory (the code portion of the stub ... on 
the stack; page 8), and to provides to all instances of the interception module the location of the 
shared memory (As the spy DLL builds each stub ... the import section; page 9). 
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15. It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to combine the teaching of Pietrek and Deianov because Pietrek teaches a method to 
monitor multiple applications by creating an extensible list of functions to be intercepted and no 
modification to the programs (page 1). 

16. As to claim 4, Deianov does not teach an instance of the interception module is 
responsive to receiving a redirected API call to load itself within the process making the API call 
so that a segment of global data is made available to each instance of the interception module. 

17. Pietrek teaches an instance of the interception module is responsive to receiving a 
redirected API call to load itself within the process making the API call so that a segment of 
global data is made available to each instance of the interception module (By freezing the target 
process . . . code for the program; pages 5-6). 

18. It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to combine the teaching of Deianov and Pietrek because Pietrek teaches sharing data 
to multiple instances of the interception module would improve the performance by reducing the 
memory usage. 

19. As to claim 11, Deianov does not teach the interception module is adapted to check that 
it is not being called recursively prior to loading itself However, Deianov teaches recursively 
execute the wrapper is avoided by check on the flag (col. 7, lines 29-40 and col. 8, lines 44-55). 
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It would have been obvious to one of ordinary skill in the art to have included checking of 
recursively called the Deianov's system because it provides a method not to load multiple 
instance of the same code into the process address space. 

20. Claims 13 is rejected under 35 U.S.C. 103(a) as being unpatentable over Deianov et al. 
(U.S. 6,529,985 Bl) in view of Hammond (U.S. 6,463,583 Bl) further in view of Admitted Prior 
Art (APA). 

21. As to claim 13, Deianov does not teach the activation module and the interception 
module are adapted to operate on OS/2 Warp Version 3 SMP and Warp Version 4.5 operating 
systems. Deianov teaches the activation module and the interception module are adapted to 
operate on the multitasking system (col, 1, lines 8-11). APA teaches OS/2 Wrap Version 3 SMP 
and Warp Version 4.5 operating system for used by 32-bit applications (page 2, lines 18-25). It 
would have been obvious to apply the teaching of APA to the system of Deianov because it 
provides a method to run the application in different operating systems. 

Response to Arguments 

22. Applicant's arguments filed 5-5-2004 have been fully considered but they are not 
persuasive. 

As to Applicant's arguments (page 6, lines 5-14) regarding Hammond does not teach 
loading an interception module to occupy a location in a shared region of virtual memory as long 
as interception of the API calls is required, and there is no motivation/suggestion to combine the 
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teaching of Deianov and Hammond because Deianov teaches that the module be loaded in the 
OS address space 105, examiner respectfully disagrees because Deianov teaches the interception 
module (a system call wrapper, an initialization module; col. 3, lines 47-54 and Fig. 1) is loaded 
into the user address space, and could be loaded into the OS address space in different 
embodiment, and Hammond teaches loading an interception module in a shared region of virtual 
memory (see rejection of claim 1 above). Hammond further teaches the location is available to 
all the processes, i.e. the interception is in the shared virtual memory as long as other processes 
still need it. Therefore, the combination of Deianov and Hammond teach the claimed limitation. 

Conclusion 

23. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 . 136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 



Application/Control Number: 09/848,201 



Page 9 



Art Unit: 2126 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Diem K Cao whose telephone number is (703) 305-5220. The 
examiner can normally be reached on Monday - Thursday, 9:00AM - 5:00PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Meng-Ai An can be reached on (703) 305-9678. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 

Any response to this action should be mailed to: 

Commissioner for Patents 
PO Box 1450 

Alexandria, VA 22313-1450 
Diem Cao 
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